Re: Auditing a program use but not what it is doing
On Wednesday, February 12, 2020 5:01:37 AM EST MAUPERTUIS, PHILIPPE wrote:
Like many, we are using aide and clamav.
I woud like to have an audit record when these program are run but no
records for what they are doing. I mean, I want to know that clamscan or
aide has been launched but not that it checks say /etc/passwd whatever
rules could be in place for /etc/passwd
Then all you need to do is place a watch on them.
-a always,exit -F path=path-to-aide -F perm=x -F key=something-ran
-Steve